liveBook · Manning

Automated provisioning

As explained in Azure Security

Auto-provisioning is the automatic deployment and configuration of required security agents or add-ons across existing and newly created resources.

Automated provisioning deploys required security agents and extensions automatically across resources. In Microsoft Defender for Cloud, it keeps virtual machines connected to security monitoring as they are created and can extend required tooling to existing machines. This reduces the risk that a newly deployed workload is left outside the security posture. section 6.2.1 section 7.2.1

For VM monitoring, the Log Analytics agent collects security-related configuration data and event logs, including operating-system logs, running processes, IP addresses, and logged-in users. It sends that data to a Log Analytics workspace, where Defender for Cloud uses it for analysis. Auto-provisioning ensures machines in an onboarded subscription send data to the selected workspace. section 6.2.1

Configure agent deployment for Defender for Servers in the Azure portal:

  • Select Continue, then Save. Repeat the process for other plans that require agents or extensions. section 7.2.1

The enabled plan determines what must be provisioned. Defender for Servers capabilities such as Microsoft Defender for Endpoint integration, file integrity monitoring, and adaptive application control rely on the Log Analytics agent. Other plans may require different components: Defender for SQL Servers on Machines uses the Log Analytics agent and automatic SQL discovery and registration, while Defender for Containers uses the Defender profile and Azure Policy Add-On for Kubernetes. section 7.2.1

Kubernetes worker-node protection

For an Azure Kubernetes Service cluster, auto-provisioning can deploy the native Kubernetes Defender profile to every worker node. The profile collects node signals for Defender for Cloud analysis, supporting detection of suspicious activity and signs of compromise, such as crypto-mining on nodes. Control-plane threat detection separately uses Kubernetes audit logs and API-server security events. section 7.2.2

A custom Log Analytics workspace can be used instead of the default workspace when centralized management or organizational naming is needed. The custom workspace must have the SecurityCenterFree solution enabled; agents can then be connected manually or through the recommended auto-provisioning approach. A custom workspace is also required when sharing a workspace with Microsoft Sentinel. section 6.2.1

Figure 7.2 Configuring auto-provisioning for the Defender profile and Azure Policy for Kubernetes

Use the configuration view to locate the auto-provisioning controls for the Defender profile and Azure Policy for Kubernetes. section 7.2.1

How Azure Security covers it

How deep it goes
Provides portal configuration steps and explains collected VM data, plan-specific dependencies, and Kubernetes node deployment.
Examples
Uses subscription-wide VM agent deployment and Defender profile deployment on Azure Kubernetes Service worker nodes.
What it assumes
Assumes an onboarded Defender for Cloud subscription; requires Azure Arc for supported multicloud and on-premises server scenarios.
What you can do after
Operate/configure it through Defender for Cloud settings to deploy required monitoring agents and extensions for supported plans.
How it connects
Connects Log Analytics workspaces, Microsoft Defender for Servers, vulnerability assessment, Microsoft Defender for Endpoint, Azure Arc, and Kubernetes.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.